In hns3_alloc_ring_memory(), when hns3_alloc_ring_buffers() fails for an RX ring, the error path jumps to out_with_desc, which frees the descriptor ring but does not destroy the page_pool that was just allocated by hns3_alloc_page_pool(). The page_pool and its pages are leaked. Destroy the page_pool in that error path as well. The pool is torn down before the descriptor ring here, which is the opposite of the order in hns3_fini_ring(); that is safe because hns3_alloc_ring_buffers() has already detached every buffer it attached, so hns3_free_desc() walks descriptors whose dma is zero and never hands a page back to the pool. Fixes: 93188e9642c3 ("net: hns3: support skb's frag page recycling based on page pool") Signed-off-by: Jijie Shao --- Changes in v4: - Name hns3_fini_ring() instead of the non-existent hns3_free_ring_memory(), and drop "mirroring" because the destroy order differs. The pool is destroyed before the descriptor ring here, which is safe because hns3_alloc_ring_buffers() has already detached every buffer. v3: https://lore.kernel.org/all/20261030095633.377289-3-shaojijie@huawei.com/ --- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index 2f3aeade558c..dbf32c00bb7f 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -5078,6 +5078,8 @@ static int hns3_alloc_ring_memory(struct hns3_enet_ring *ring) return 0; out_with_desc: + page_pool_destroy(ring->page_pool); + ring->page_pool = NULL; hns3_free_desc(ring); out_with_desc_cb: devm_kfree(ring_to_dev(ring), ring->desc_cb); -- 2.43.0